KYC and CDD refresh

How do we run KYC and CDD refreshes on schedule without a relationship manager chasing customers by email?

Make the refresh a process that starts itself. Callvu opens a case when the risk-based schedule or a trigger event says a customer is due, prefills what the bank holds, asks the customer and the owners only for what has changed, checks the answers, routes the BSA review, and writes the refreshed profile and risk rating to the core and the BSA system. Live at Bank Leumi, under national rules outside the US.

Live at Bank LeumiComplex: multi-party handoffsCallvu moves: prefill, classify, chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 6, 2026.

The problem today

The refresh list is a spreadsheet, and the customers who matter most are the hardest to reach.

Today, without Callvu

The BSA system produces a list of customers due for review. A relationship manager emails each one a form, waits, emails again, and forwards whatever comes back to the BSA analyst. High-risk customers, who are due most often, are the ones with the most owners to confirm and the least patience for a form they filled last year.

The rule asks for a risk-based approach: a customer risk profile, ongoing monitoring, and customer information updated when the bank learns of a change. What the examiner finds instead is a backlog: reviews past due, forms returned incomplete, and a risk rating in the system that nobody can tie to the information it was supposed to rest on.

A trigger event (a new owner, unusual activity, a change of business) should start a refresh the day it happens. When the trigger lives in one system and the refresh in another, it starts when someone notices.

How it runs

From the requestto the system of record.

Callvu opens a refresh case when the risk-based schedule reaches the customer's due date, or when a trigger event arrives from the BSA or core system (a change of ownership, unusual activity, a 314(a) match, a change in the nature of the business).

Customer: Confirms or updates their information, ownership and expected activity, and provides documents where something changed.
Relationship manager: Sees the case, is told when the customer has not responded, and answers questions; no longer runs the chase.
BSA team: Reviews the refreshed profile where policy requires it, sets or confirms the risk rating, and decides on escalations.
Callvu: Starts the case on schedule or trigger, prefills, chases, verifies, routes the review and writes the refreshed profile back.

Start on schedule or trigger
The customer's risk rating sets the refresh cycle; a trigger event starts an out-of-cycle refresh. Either way Callvu opens the case with the reason recorded, and the clock starts from that date.
Prefill from the record
The profile the bank holds (identity, address, ownership, nature of business, expected activity) is prefilled. The customer confirms each item or marks what changed; they do not retype what is unchanged.
Classify the refresh
The customer type and risk rating decide the depth: a confirmation for a low-risk consumer; ownership, source of funds and activity for a business; enhanced due diligence items for a high-risk customer. Callvu sets the required items from the BSA policy.
Chase and verify
The customer and, where ownership changed, each new owner are asked for only the items that are missing or changed, with a link. Documents are read and checked as they arrive; new owners are identified and screened. The case shows what is outstanding and for how long.
Decide
A refresh that confirms the profile with no change and no screening hit closes automatically where policy allows. A changed owner, a screening hit, an activity pattern outside the expected profile or an enhanced due diligence case routes to the BSA team in the Decision Desk with the allowed outcomes: confirm the rating, raise it, request more, or escalate.
Write back
The refreshed profile, the ownership, the expected activity, the risk rating and the review decision are written to the core and the BSA system with the date, and the next due date is set from the rating.

Where it ends: The customer's profile and risk rating are current in the core and the BSA system, with the review date and the reviewer recorded. The Decision Trace shows what was checked and why the rating was set; the Audit Trace shows every request, answer and decision.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

US requirements shown. Bank Leumi runs this process under national rules outside the US; Callvu loads each market's rules as policies the same way.

CDD rule: ongoing monitoring and updating (31 CFR 1020.210(b)(5)): The bank conducts ongoing customer due diligence: understanding the nature and purpose of the relationship to develop a customer risk profile, and ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership, when the bank detects a change.
Beneficial ownership (CDD rule, 31 CFR 1010.230): When a refresh or a trigger reveals a change in ownership of a legal entity customer, each new beneficial owner (25 percent or more equity, and the control person) is identified and verified, with an updated certification.
BSA/AML program and 314(a) (31 CFR 1020.210, 1010.520): The bank's AML program includes risk-based procedures for customer due diligence, and the bank searches its records for 314(a) requests within the required period. A match is a trigger for review.

Company policies

The refresh cycle per risk rating, and the trigger events that start an out-of-cycle refresh, are set by the bank's BSA policy and applied by Callvu.
Enhanced due diligence items for high-risk customers are required items, not a checklist outside the process.
A refresh with a screening hit or an ownership change cannot close without a BSA team decision.
The BSA system is the system of record for the risk rating; the core holds the customer profile.

Controls

Automatic case start on the due date or the trigger event, with the reason recorded.
Required items set by customer type and risk rating.
Per-item chase with the outstanding list and its age on the case.
Identification and government list screening for every new owner.
Expected activity compared with the activity the core shows.
Decision Desk routing for hits, ownership changes and enhanced due diligence, with allowed outcomes only.
Next due date set from the rating at close.

Clocks and deadlines

Refresh cycle: Set by risk rating in the bank's BSA policy; Callvu starts the case on the due date and tracks it until closed.
Trigger event: An out-of-cycle refresh starts the day the trigger arrives.
314(a) search: Records searched within the period FinCEN sets for each request; a match starts a review.

Documents and checks

The prefilled profile with the customer's confirmations and changes
Updated beneficial ownership certification where ownership changed, with each new owner's identification
Source of funds or wealth documents where the risk rating requires them
Government list screening results
The BSA team's decision and the risk rating with its date

In the Decision Trace

Why the refresh started (schedule or trigger) and the depth the risk rating required.
Each item confirmed or changed, and each verification result.
The comparison of expected and actual activity.
The rating decision, the reviewer, and the next due date.

In the Audit Trace

Every request to the customer and each owner, with when it was answered.
Each document received and read, with its result.
Every Decision Desk step with the person and the time.
The writes to the core and the BSA system, and what was written.

The handoff

Between the front doorand the back office.

The front door

The front door is the schedule or the trigger, not a customer walking in. The customer meets the process through a link and confirms or updates their information on their own phone.

The back office

The BSA team receives only the cases that need a decision, each complete. The relationship manager is informed, not tasked. The profile and rating land in the core and the BSA system without re-keying.

The Decision Desk

A screening hit, an ownership change, an activity pattern outside the profile or an enhanced due diligence case goes to the BSA analyst in the Decision Desk with the full profile and only the allowed outcomes.
A customer who does not respond is nudged on a schedule; after the policy's limit the case escalates to the relationship manager and the BSA team rather than lapsing.

Proof

Live at Bank Leumi.Published results only.

Each result is a published claim, with its code on agents.callvu.com, where its status, source and last verified date are kept.

Bank Leumi reached a 94% average completion rate.

BNK-16 · Customer-attested · verified 2026-11-02

Bank Leumi cut data errors by 77%.

BNK-03 · Customer-attested · verified 2026-11-02

Bank Leumi cut digital development timelines by 91%.

BNK-17 · Customer-attested · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

Does the customer have to fill in the whole form again?

No. The profile the bank holds is prefilled. The customer confirms each item or marks what changed, and is asked for documents only where something changed or the risk rating requires them.

What starts an out-of-cycle refresh?

A trigger event from the BSA or core system: a change of ownership, unusual activity, a 314(a) match, or a change in the nature of the business. The case opens the day the trigger arrives, with the reason recorded.

Can a refresh close without the BSA team?

Only where policy allows it: a low-risk profile confirmed with no change and no screening hit. Anything else routes to the BSA team in the Decision Desk.

Where does the risk rating live?

In the BSA system, which stays the system of record. Callvu writes the rating, the review date and the reviewer there, and sets the next due date from it.

What does the examiner get?

For every customer, when the refresh started and why, what was confirmed or changed, what was verified, who set the rating, and when it is next due, in the Audit Trace.

Related processes

Business account opening Power of attorney registration Account servicing changes Try it in the sandbox All banking and credit unions processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.